chore(deps): update dependency @circleci/mcp-server-circleci to v0.20.0

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@circleci/mcp-server-circleci	0.19.1 → 0.20.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

CircleCI-Public/mcp-server-circleci (@​circleci/mcp-server-circleci)

v0.20.0

Compare Source

Deprecated

• This package is deprecated in favour of CircleCI's hosted MCP server and the CircleCI CLI MCP. See https://circleci.com/docs/guides/toolkit/circleci-mcp-overview/. This repository will be archived.
• The server now prints a deprecation banner to stderr at startup (both transports), where MCP clients surface it in their logs. There is no opt-out: an off-switch would be adopted by exactly the high-volume operators who most need to migrate, and the server already logs to stderr unconditionally on every start.
• Every tool description now carries the deprecation notice. Tool descriptions enter the model's context, so the assistant relays the notice in conversation — the only channel that reaches users who never open a log file. Almost the entire installed base runs npx -y @circleci/mcp-server-circleci@latest from an MCP client config that re-resolves on every start, so the package itself is the only reliable way to reach them; a README notice is not.

Nothing in this release changes tool behaviour, arguments, or output. The deprecation is deliberately non-breaking: a server that stops working gets pinned to the last working version, which strands operators on an unmaintained release rather than moving them forward.

v0.19.2

Compare Source

Security

• The remote transport now refuses to start when request authentication is disabled (REQUIRE_REQUEST_TOKEN=false, the shared-token mode) and it would bind a non-loopback interface — which the default MCP_BIND_HOST=0.0.0.0 does. That combination served the org's CIRCLECI_TOKEN to any peer that could route to the port, with no credential, including run_pipeline with arbitrary pipeline config. Operators who genuinely have the port restricted to a trusted network can opt back in with MCP_ALLOW_UNAUTHENTICATED_NETWORK_ACCESS=true; a loud warning is logged whenever request auth is off.
• Clarified that the Host/Origin validation added in 0.17.0 is a DNS-rebinding mitigation and not authentication. Both headers are chosen by the caller, so a non-browser client can always satisfy the check by sending an allowed Host and omitting Origin; it was never an access-control boundary, and the docs no longer read as though /mcp is protected by it. Authentication is REQUIRE_REQUEST_TOKEN (on by default, returns 401) or an authenticating proxy. The absent-Origin allowance is retained deliberately: requiring the header would break mcp-remote, curl and every other non-browser client while stopping no attacker.

Added

• MCP_ALLOW_UNAUTHENTICATED_NETWORK_ACCESS — set to true to acknowledge running the shared-token mode on a network-reachable interface. Required in that configuration; ignored when request tokens are required.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[toolhive-release-app]

🔒 MCP Security Scan Results

✅ mcp-server-circleci

• Status: Passed
• Tools scanned: 13
• Result: No security issues detected

---

Summary: Scanned 1 MCP server(s), all passed security checks. ✅